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Method and Integrated Circuit for Increasing the Immunity to 
I n ter f erence 



The present invention relates to integrated circuits, in 
particular in electronic control units, being preferably 
components of motor vehicle control units. In particular, the 
control units concern control units for motor vehicle brake 
systems. Control units of this type are, among others, 
appropriate for performing safety-critical control operations. 
The motor vehicle control units preferably comprise control 
programs such as ABS, TCS, ESP, and. similar systems. Due to 
the high safety requirements, the control systems formed of 
the integrated circuits comprise safety circuits, which help 
detecting failure or a defect and initiate appropriate 
measures such as deactivation of the overall system or an 
emergency operation due to measures that partly preserve the 
operation of the controlled system. 

Control systems with integrated circuits comprising 
microprocessors are generally known for the above-mentioned 
tasks. To prevent malfunctions or to detect them, it is 
suitable to arrange for at least two processor cores. 
Admittedly, three or more processor cores would increase 
safety even further, however, this is not always desired for 
cost reasons in connection with the large scale manufacture 
being customary in the field of motor vehicle technology. 
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Therefore, there is a demand for low-cost circuits with a high 
safety level* 

For example, a concept of a control system, which is composed 
of two integrated circuits accommodated in separate chip 
housings, has stood the test. This concept achieves the 
advantage of a spatial separation of power elements (Power 
FETs etc.) and highly integrated microprocessor components ]iC, 
memories, etc.). 

The error-relevant communication favorably takes place by way 
of two error lines ERR and ERR_N in the above example. 

The invention is based on a system as mentioned above and 
improves it in order to further improve the immunity to 
interference . 

According to the invention, this object is achieved by a 
method according to claims 1 and 2 and an integrated circuit 
according to claim 15. 

Further, the control system can possess one or more monitoring 
circuits, which are incorporated in particular on one or more 
additional separate chips (watchdog) . 

In the prior art electronic controller, processor chip and 
power chip are advantageously interconnected by way of the 
lines ERR and ERR_N. In this arrangement, the power chip must 
be able to detect pulses of the processor chip, which are 
transmitted on ERR or ERR_N, respectively, with a minimum 
pulse width of e.g. T min = 30 nanoseconds. It is possible that 
external electrostatic, magnetic, or electromagnetic 
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interferences (e.g. frictional electricity, ESD) intervene 
into the system and have undesirable effects. 

According to the invention, methods as well as integrated 
circuits are described according to the independent patent 
claims in order to enhance the immunity to interference, 
especially the immunity to interference of the signals ERR and 
ERR_N. This brings about better system availability. 

Following a basic idea of the invention, the following 
measures are taken in particular, either separately or in any 
combination desired: 

• Considerable extension of the minimum pulse width T M i n 

• Filtering of the signals ERR and ERR_N in the power chip 

• New definition of the watchdog time window in the power 
chip with the introduction of the delay time Wi ndowDe lay 

• Introduction of the block ' toggle and delay' in the 
processor chip in order to safeguard the minimum pulse 
width T M in- 

The following advantages are hereby achieved: 

• Filtering the power chip input signals ERR and ERR__N 
allows improving the system's immunity to interference to 
a major degree. Especially the influence of 
electrostatic, magnetic, or electromagnetic interferences 
is considerably reduced because these interferences are 
usually of a short duration and, on account of the new, 
larger minimum pulse length, cannot be interpreted 
erroneously as error signals. 
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• The method of the invention achieves that the power chip 
will not cause any restriction in the error monitoring of 
the processor chip compared to the previous, unfiltered 
solution. This means, error pulses will not get lost. 

The integrated circuit comprises at least one microprocessor 
chip or multi-processor microcontroller and at least one 
further component, which is more particularly an integrated 
component. The integrated component preferably comprises 
power elements and therefore is a mixed-signal component in 
particular . 

Problems are encountered due to the generally considerably 
higher clock frequency of the microprocessor components 
compared to the mixed-signal components. As a result, 
consecutive error events can follow each other so closely 
that they can no longer be easily distinguished from other 
interferences . 

Alternatively, the invention can be implemented especially 
in the following manner: 

• Digital filtering can be replaced by analog filtering. 

• When the microcontroller (processor chip) works much more 
slowly than the mixed-signal chip (power chip) , a digital 
filtering operation can be performed without the 'toggle 

& delay' block in the microcontroller. 

Further preferred embodiments can be seen in the sub claims 
and the following description of the Figures. 
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Hereinbelow the invention will be explained in detail by way 
of examples. 

In the drawings : 

Figure 1 is a system overview of the interconnected chips, 

Figure 2 is an illustration of the filtering characteristics 
in connection with the error lines; and 

Figure 3 is a diagram showing the time behavior of the 
signals (timing diagram) . 

Figure 1 depicts a system overview: 

In the electronic controller of a motor vehicle brake system, 
the microcontroller 1 (processor chip) is connected to the 
mixed-signal-IC 2 (power chip) by way of the error lines 3 and 
4 as well as by way of the SPI-interf ace 5. 

The microcontroller 1 comprises two independent processor 
cores (core A and core B) , the operations of which are 
continuously checked in terms of their hardware by the 
comparison blocks Compare A and Compare B. When an error is 
detected in this comparing operation, this error information 
must be reliably transmitted to power chip 2 through the lines 
3 ERR and 4 ERR__N . 

According to the method, an error is favorably signaled 
because the level changes on an error line (e.g. from logical 
'High' to 'Low' ) . 
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It is provided in particular, that each of the lines 3 ERR and 
4 ERR_N changes the signal level one time with each error. The 
levels on ERR and ERR_N are preferably opposed or 
complementary . 

The mixed signal IC 2 generally and preferably works at a 
considerably slower rate than the microcontroller. It must be 
ensured for this reason that the pulse width does not fall 
under the minimum pulse width T min on the signal lines ERR and 
ERR_N. Otherwise, it is possible that component 2 *fails to 
notice' an error. 

These two tasks are complied with in the blocks ^toggle & 
delay r 6 and 6'. If several errors prevail in the processor 
chip, the changes of levels on ERR and ERR_N are delayed 
( Melay' ) , in order to guarantee the minimum pulse width T min . 

The mixed signal IC filters in each case the ERR/ERRJST signals 
with respectively one filtering device 7, 1' . This filtering 
operation takes place digitally, in particular. In a preferred 
manner, a filter time constant T Fi iter is provided. The minimum 
pulse width T min is advantageously much longer than the 
internal system clock of the power chip 2. 

Filtering the signals ERR/ERR_N advantageously allows 
suppressing external interferences (electrostatic, magnetic, 
or electromagnetic interferences), whereby the reliability and 
availability of the system is increased. 

It is checked redundantly in the blocks x level compare' 8, 8' 
whether both error signals have opposed levels. Identical 
levels on ERR and ERR N lead to an error and, further, are 
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output outside a testing routine on the signals x error 
detected' 9, 9'. In addition, the block 'pulse detect' 10, 10' 
searches for edges on the filtered ERR/ERR_N signals. The 
signal outputs of block 'level-compare' 8 and 'pulse-detect' 
10 are logically operated by an OR-element and form the output 
X ERR detected A' 9. The same applies to the redundant path 
11' . 

In the electronic controller of the example, a watchdog 
testing routine with an artificial error transfer over the SPI 
interface 5 from processor chip 1 to power chip 2 is signaled 
in regular intervals T Lo0 p. The error detection in the 
microcontroller and the connections between power chip and 
processor chip through the error lines are tested during this 
testing routine. Using test structures actuated by software, 
an error is produced in the microcontroller and causes a one- 
time change in levels on the ERR/ERRN lines at the output of 
the blocks x toggle and delay' . 

While the testing routine ('watchdog transfer') is active, 
power chip 1 defines via bus 5 a time window in block 50. 
Within the time window, in particular a signal is considered a 
valid error signal for testing, which is composed of exactly 
one change of edge on the filtered ERR and the ERR_N-line. An 
error is detected by the block 'pulse detect' 10 (or 10' in 
the redundant branch B) , when no edge or more than one edge 
appears on the filtered signals of ERR-filter or ERR__N-f ilter 
within the time window (see timing diagram in Figure 2) . Level 
monitoring 8 is disabled during the watchdog transfer by means 
of line 18 (18' in the redundant branch B) , because the change 
of levels on ERR and ERR_N cannot be absolutely synchronous 
due to different signal running times. 
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At the end of the time window defined by block 50, the signals 
ERR/ERR_N must have opposed levels again because now the level 
monitoring operation of the filtered signals re-commences. 

If there occurs a change in level on the filtered signals 
ERR or ERR__N outside the watchdog time window, this condition 
is detected directly as an error by block x pulse detect' 10 
and output on line *ERR detected' 9. In order to achieve this 
mode of function, block 50 connects to block 10 by way of a 
control line . 

Block 'level-compare' 8 is also provided redundantly (see 
block 8") . A check is made in block 8 whether the error 
signals of the complementary error lines are both provided. In 
the negative, e.g. if one of the error lines is defective, an 
error is output. 

Figure 2 indicates how an implementation of the ERR-filters 7 
or 7 ' , respectively, can take place: 

As can be seen in Figure 1, the error detection for the lines 
3 ERR and 4 ERR_N principally has a redundant design in power 
chip 2. Therefore, each processor core is favorably provided 
with its own error detection circuit 11 and 11' with a 
respective own error line 9 ' ERR-detected A' and 9' ' err- 
detected B' . Advantageously, the filter 7 in circuit 11 is 
provided only for one of the existing error lines 3 and 4 for 
the purpose of reducing the costs of manufacture. There is 
likewise only one filtering circuit 7' in circuit 11' . In both 
circuits 11 and 11', the output of the filter 7 or 7' , 
respectively, with the connecting points 12 and 12' is led via 



cross lines 13 and 13' to the inputs of the x level-compare' 
circuits 8 and 8' beside the error signals 3 and 4 on the 
inlet side. To this end, the result of the filtering operation 
is hence respectively fed back into the block ERR-check B 11'. 
In the reverse case, the same applies to the ERR_N filter, the 
result of which is fed back into the block ERR-check A 11. The 
feedback operation is used in each case for the test in terms 
of inverted levels. 



ERR-filter 7 is preferably designed as a digital 
forward/backward counter, which changes its count depending on 
the input signals. If a signal with the digital low-level 
prevails at the input of the filter, the count is reduced by 
one. If a high-level prevails, the count is increased by one. 
The possible counts of the counter are limited to the range 
between 0 and Z Ma xcount. Figure 2 illustrates a possible signal 
variation. The same applies to filter 7". 



When the count of the counter of filter 7 reaches the value 
zero, the output of the filter at point 12 adopts Low. When 
the count reaches the value Z Ma xcount/ the output of the filter 
adopts High. Along with the clock frequency fpower chip used, a 
filtering time of 
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is reached, where F CP u is the clock frequency of the 
microprocessor. This implementation is used to suppress all 
interferences, which are shorter than T Fi i te r and detected by the 
sampling system. The count of the filter is shown in Figure 2 
as a function of the input of the filter. 



Figure 3 represents a timing diagram, which illustrates the 
logical levels of the existing control lines as a function of 
time. A possible definition of a watchdog time window in block 
50 is now explained by way of this Figure. The watchdog time 
window in block ^watchdog window' 50 is determined by the 
processor chip 1, using the SPI-interf ace 5. Processor chip 1 
selects the watchdog transfer by the chip select signal CSVO_N 
= low and CSWD_N = high. 

The watchdog-time window 17 starts after the first leading 
edge 14 on the clock signal of the SPI-transfer SPICLK. The 
delay TSync comprises signal running times as well as the 
synchronization time between the external clock of the SPI- 
interf ace and the internal power chip system clock. 

The watchdog time window 17 ends per se after the leading edge 
15 of CSWD_N. However, it must be safeguarded that the edges 
of the filtered signals ERR or ERR__N, respectively, are 
detected still within the active watchdog-time window. 
Following the point of time of edge 15 is, for this reason, a 
delay time TwindowDelay/ in which the expected edge is still 
processed. The following condition applies then: 

TwindowDelay ^ T Filter 

However, this condition satisfies the requirements only in a 
fail-free system. If the effect is considered though that 
interferences on the input signal cause an additional delay, 
the most robust and less sophisticated system is obtained with 

TwindowDelay w 2 ■ Tpnter/ 



because the presented filtering delay in the system that 
failed can never become greater than the double filtering 
time . 

In this respect, the following demands must be placed on the 
signal delay within the processor chip 1: 

Outside the time, during which the error testing routine is 
running (watchdog transfer) , a one-time error event inside a 
processor chip 1 always leads to an error detection inside the 
power chip 2. In this case, processor chip 1 is only required 
to guarantee that the pulse length does not fall under the 
minimum pulse length T Min on the signals ERR or ERR_N, 
respectively. 

During an error testing routine (watchdog transfer) , in which 
a time window is defined by way of bus 5, it must be 
guaranteed that, apart from the error being caused by the 
testing procedure, every additional error is reliably detected 
by the power chip 2. In this case, processor chip 1 must 
change one time the levels on the error lines ERR/ERR_N for 
the first error that occurs. If another error appears in the 
processor chip 1 during the time T M in, this error must be 
delayed until the expiry of the time T M in. Subsequently, 
processor chip 1 must change the signal levels on ERR/ERR__N 
again. This is done by the device 6 or 6', respectively 
( ^toggle and delay' ) . In this case, either the double change 
in levels during the watchdog time window 17 is detected in 
power chip 2, or a change of levels occurs outside the time 
window 17. The power chip 2 detects the additional error in 
both cases. 



A double change in levels at an interval of T M in will thus be 
sufficient in all cases in order to detect an error in the 
power chip. Hence, the block x toggle & delay' 6 or 6', 
respectively, in addition to the first error that occurs, must 
transmit only one further error to the power chip, delayed by 

TMin • 



